Analysis Computer Control System Once the vessel was secured in the lock, the opening of Bridge12 was initiated by the HSO. Before the bridge reached its full open position, the upper approach lights were switched from green to red by CSO1 from the upper control kiosk using the lock computer control system. As a consequence, the undesirable programming characteristic of the lock computer control system resulted in the warning bells ceasing and the bridge stopping at 92percent of its fully raised position. Four indications are available to the lock operator to indicate that the bridge is fully raised: the computer mimic display indicates full open; the numeric display indicating the percentage that the bridge is open; the end fully open and locked notification; and a white light at the centre span of the bridge and the ship arrester. When the bridge is in motion, a bell sounds on the bridge structure, indicating to operating staff that the bridge is in motion. When it stops moving, the bell stops, regardless of the position of the bridge. As the bridge opens, in addition to the digital numeric readout, the mimic display at the control stations shows an animation that diminishes in size relative to the angle of bridge opening. The display is such that the animation is not readily discernable during the final 10degrees of bridge opening, and therefore careful attention to the digital readout is critical. The computer-initiated interruption of the bridge coincided with the pilot on the Federal Mass requesting that the HSO read the vessel's draught. This request distracted the HSO, who did not check the white light on the central span to verify that the bridge was fully open. Additionally, the master and the pilot did not confirm that the bridge was fully open before the vessel commenced exiting the lock. Interlocks are commonly used in machinery installations to ensure that an operation cannot be carried out unless preset safe conditions are present. There is no interlock between the bridge and the arrester boom and gates at Iroquois Lock. It is possible to operate the lower end of the lock (that is, raise the lower arrester boom/wire and open the lower gates) without the bridge being fully open. If for any reason5 Bridge12 did not open fully, it would be possible for a vessel to attempt to enter or exit the lock and strike the bridge. Lock Operations In the absence of physical interlocks that prevent a vessel from exiting the lock before all obstructions have been cleared, the supervisory role of the HSO takes on added importance. At the time of the occurrence, the traffic control lights, lock gates, arrester wires, lights, and Bridge12 were being operated by two separate lock personnel, at opposite ends of the lock. The HSO was multi-tasking, requiring him to work outside the control room to assist with the lockage of the vessel. Consequently, there was no person dedicated solely to monitoring the operation of the lock. The central control station at the centre of the lock provides the operator a clear view of the upper and lower ends of the lock, as well as computer displays of the machinery status and CCTV displays from various camera locations in the lock area. Similar computer and CCTV displays are located at the upper and lower kiosks; however, the placement of the CCTV cameras provided a less-than-optimum view of the entire lock. Additionally, the bridge is not visible from the upper control kiosk and the view from the lower kiosk is such that the difference between 92percent and 100percent open is not readily discernable. Viewed down the lock from the central control location, the difference in elevation angle is more evident. As two people are required to put mooring lines1 and3 onto their bits, the level of staffing is such that, to minimize the lockage time of the vessel for safety purposes, the HSO must leave the central control station to physically assist in the lockage operation. The advantages provided from such a central control station are therefore negated. Such an approach has the potential for the HSO to not fully appreciate the existing and developing situation, thereby compromising the vessel's safe transit through the lock. The HSO does not have a clear view of the entire lock from either the lower or upper end control stations, and must rely on instrumentation as well as the other staff members to provide feedback on the disposition of the vessel and lock machinery. The locking procedure is known to the lock crew; however, no written checklists are used to ensure that lock machinery is operated in the appropriate sequence. Although the lock staff had been previously briefed on the computer control problem, the procedures for operating the lock had not been modified to reduce the possibility of the programming flaw affecting the operation of the bridge, or mitigate any consequences resulting therefrom. In the absence of formal checklists and modified procedures, the tasking of the HSO to physically participate in the lockage of the vessel hampered his ability to fully appreciate the situation. A known programming fault in the lock control system resulted in Bridge12 stopping before the fully raised position. Although visual and audible cues were available, the head structures operator (HSO) became distracted and did not notice that the bridge had not opened fully. There was no formal checklist and, because procedures were not modified, the tasking of the HSO to physically participate in the lockage of the vessel hampered his ability to fully appreciate the situation.Findings as to Causes and Contributing Factors A known programming fault in the lock control system resulted in Bridge12 stopping before the fully raised position. Although visual and audible cues were available, the head structures operator (HSO) became distracted and did not notice that the bridge had not opened fully. There was no formal checklist and, because procedures were not modified, the tasking of the HSO to physically participate in the lockage of the vessel hampered his ability to fully appreciate the situation. There is no mechanical barrier to prevent gates and arrester booms from operating if the bridge is not fully raised. This allows vessels to enter or exit the lock and potentially strike the bridge.Finding as to Risk There is no mechanical barrier to prevent gates and arrester booms from operating if the bridge is not fully raised. This allows vessels to enter or exit the lock and potentially strike the bridge. On 12November2004, a Marine Safety Information letter (MSI 08/04) was sent to the St.Lawrence Seaway Management Corporation (SLSMC), noting that there is no interlock between the bridge and the arrester boom/gates, and that it is still possible to raise or lower the arrester boom/wire and open the lower gates without the bridge being fully open. The MSI also highlighted that, because there were only three persons on duty at the time, the head structures operator (HSO) was multi-tasking and was required to work outside the control room to assist with the lockage of the vessel. As such, there was no person dedicated solely to monitoring the operation of the lock and the position of Bridge12. In response, the SLSMC indicated that it had initiated an internal investigation into the occurrence, which would include recommendations for improvement. The completed investigation included recommendations addressing control systems, equipment, operating procedures, and change management. For example: the visibility of the bridge span mimic has been modified to eliminate the animation that reduces the size of the mimic as the bridge rises; the interlock sequence was modified to ensure that a change from a green to a red navigation light does not stop the equipment during its operation; an additional interlock has been added whereby Bridge12 (Iroquois) must be fully raised before a green light (allowing a vessel to proceed into the lock) is displayed for a downbound vessel; the audible tone will keep sounding while the equipment is between fully open and fully closed; a cast-off light, for use by the lock crew, will be activated when all end equipment is fully open; a simulator system is available for evaluating and testing changes off-line before the commissioning of control system changes; operating procedures have been reviewed and a walk-through mode procedure is in place at Iroquois Lock; the entire change-management process for control system changes has been examined and will be completed during the 2007-2008 fiscal year.Safety Action Taken On 12November2004, a Marine Safety Information letter (MSI 08/04) was sent to the St.Lawrence Seaway Management Corporation (SLSMC), noting that there is no interlock between the bridge and the arrester boom/gates, and that it is still possible to raise or lower the arrester boom/wire and open the lower gates without the bridge being fully open. The MSI also highlighted that, because there were only three persons on duty at the time, the head structures operator (HSO) was multi-tasking and was required to work outside the control room to assist with the lockage of the vessel. As such, there was no person dedicated solely to monitoring the operation of the lock and the position of Bridge12. In response, the SLSMC indicated that it had initiated an internal investigation into the occurrence, which would include recommendations for improvement. The completed investigation included recommendations addressing control systems, equipment, operating procedures, and change management. For example: the visibility of the bridge span mimic has been modified to eliminate the animation that reduces the size of the mimic as the bridge rises; the interlock sequence was modified to ensure that a change from a green to a red navigation light does not stop the equipment during its operation; an additional interlock has been added whereby Bridge12 (Iroquois) must be fully raised before a green light (allowing a vessel to proceed into the lock) is displayed for a downbound vessel; the audible tone will keep sounding while the equipment is between fully open and fully closed; a cast-off light, for use by the lock crew, will be activated when all end equipment is fully open; a simulator system is available for evaluating and testing changes off-line before the commissioning of control system changes; operating procedures have been reviewed and a walk-through mode procedure is in place at Iroquois Lock; the entire change-management process for control system changes has been examined and will be completed during the 2007-2008 fiscal year.